Host file write via compressor argument injection

Argument injection in Incus before 7.2.0 allows remote authenticated users to write arbitrary host files through backup creation. The compression_algorithm validator allowlists only the first shell-split token, while compressFile passes every remaining token as arguments to the selected compressor. An authenticated user able to write into an instance and create its backup can use zstd output options to overwrite a root-owned cron file and execute commands as root.